Abstract: Systems, methods, and computer-readable storage media are provided for provisioning a common subnet across a number of subscribers and their respective virtual networks using dynamically generated network policies that provide isolation between the subscribers. The dynamic generation of the network policies is performed when a host (e.g. client) is detected (via a switch) as the host joins the computing network via virtual networks. This ability to configure a common subnet for all the subscriber virtual networks allows these subscribers to more easily access external shared services coming from a headquarter site while keeping the separation and segmentation of multiple subscriber virtual networks within a single subnet. This allows the Enterprise fabric to be more simple and convenient to deploy without making security compromises.

Abstract: Systems, methods, and computer-readable storage media are provided for provisioning a common subnet across a number of subscribers and their respective virtual networks using dynamically generated network policies that provide isolation between the subscribers. The dynamic generation of the network policies is performed when a host (e.g. client) is detected (via a switch) as the host joins the computing network via virtual networks. This ability to configure a common subnet for all the subscriber virtual networks allows these subscribers to more easily access external shared services coming from a headquarter site while keeping the separation and segmentation of multiple subscriber virtual networks within a single subnet. This allows the Enterprise fabric to be more simple and convenient to deploy without making security compromises.

Abstract: Systems, methods, and computer-readable storage media are provided for provisioning a common subnet across a number of subscribers and their respective virtual networks using dynamically generated network policies that provide isolation between the subscribers. The dynamic generation of the network policies is performed when a host (e.g. client) is detected (via a switch) as the host joins the computing network via virtual networks. This ability to configure a common subnet for all the subscriber virtual networks allows these subscribers to more easily access external shared services coming from a headquarter site while keeping the separation and segmentation of multiple subscriber virtual networks within a single subnet. This allows the Enterprise fabric to be more simple and convenient to deploy without making security compromises.

Abstract: Systems, methods, and computer-readable storage media are provided for provisioning a common subnet across a number of subscribers and their respective virtual networks using dynamically generated network policies that provide isolation between the subscribers. The dynamic generation of the network policies is performed when a host (e.g. client) is detected (via a switch) as the host joins the computing network via virtual networks. This ability to configure a common subnet for all the subscriber virtual networks allows these subscribers to more easily access external shared services coming from a headquarter site while keeping the separation and segmentation of multiple subscriber virtual networks within a single subnet. This allows the Enterprise fabric to be more simple and convenient to deploy without making security compromises.

Abstract: Systems, methods, and computer-readable storage media are provided for provisioning a common subnet across a number of subscribers and their respective virtual networks using dynamically generated network policies that provide isolation between the subscribers. The dynamic generation of the network policies is performed when a host (e.g. client) is detected (via a switch) as the host joins the computing network via virtual networks. This ability to configure a common subnet for all the subscriber virtual networks allows these subscribers to more easily access external shared services coming from a headquarter site while keeping the separation and segmentation of multiple subscriber virtual networks within a single subnet. This allows the Enterprise fabric to be more simple and convenient to deploy without making security compromises.

Abstract: Systems, methods, and computer-readable storage media are provided for provisioning a common subnet across a number of subscribers and their respective virtual networks using dynamically generated network policies that provide isolation between the subscribers. The dynamic generation of the network policies is performed when a host (e.g. client) is detected (via a switch) as the host joins the computing network via virtual networks. This ability to configure a common subnet for all the subscriber virtual networks allows these subscribers to more easily access external shared services coming from a headquarter site while keeping the separation and segmentation of multiple subscriber virtual networks within a single subnet. This allows the Enterprise fabric to be more simple and convenient to deploy without making security compromises.

Abstract: An application switch instantiates two application-side network service instances for the same application. Each network service instance is characterized by a common Internet Protocol (IP) address, a common Open Systems Interconnection (OSI) reference model layer 2 (L2) media access control (MAC) address, and a unique (for the application) supplemental L2 identifier. The application switch maintains a mapping between a {client IP address, client port} tuple and a particular instantiated network service instance based at least in part on the supplemental L2 identifier of a particular one of the instantiated first and second network service instances.

Abstract: An application switch instantiates two application-side network service instances for the same application. Each network service instance is characterized by a common Internet Protocol (IP) address, a common Open Systems Interconnection (OSI) reference model layer 2 (L2) media access control (MAC) address, and a unique (for the application) supplemental L2 identifier. The application switch maintains a mapping between a {client IP address, client port} tuple and a particular instantiated network service instance based at least in part on the supplemental L2 identifier of a particular one of the instantiated first and second network service instances.

Abstract: At a data switching device in a data center, it is detected whether a host has connected to a cloud computing network of which the data switching device and the data center are components. The detection is performed without directly communicating with the host. The data switching device determines properties of the host and generates a message comprising data representative of the properties of the host. The message is sent from the data switching device to a node in the cloud computing network that is configured to manage components of the cloud computing network associated with the host.

Abstract: In one embodiment, at a packet-forwarding engine for receiving packet flows and conditionally routing packets in the packet flows to one or more applications, a method includes receiving from a particular one of the applications a request that requests the packet-forwarding engine not to route the particular one of the packet flows to the particular one of the applications and identifies one or more conditions for routing particular ones of the packets in the particular one of the packet flows to the particular one of the applications. The method further includes, receiving a particular packet in the particular one of the packet flows, determining whether one or more of the conditions for routing the particular packet to the particular one of the applications are met, and routing or not routing the particular packet to the particular one of the applications based on the determination.

Abstract: In one embodiment, at a packet-forwarding engine for receiving packet flows and conditionally routing packets in the packet flows to one or more applications, a method includes receiving from a particular one of the applications a request that requests the packet-forwarding engine not to route the particular one of the packet flows to the particular one of the applications and identifies one or more conditions for routing particular ones of the packets in the particular one of the packet flows to the particular one of the applications. The method further includes, receiving a particular packet in the particular one of the packet flows, determining whether one or more of the conditions for routing the particular packet to the particular one of the applications are met, and routing or not routing the particular packet to the particular one of the applications based on the determination.

Abstract: At a data switching device in a data center, it is detected whether a host has connected to a cloud computing network of which the data switching device and the data center are components. The detection is performed without directly communicating with the host. The data switching device determines properties of the host and generates a message comprising data representative of the properties of the host. The message is sent from the data switching device to a node in the cloud computing network that is configured to manage components of the cloud computing network associated with the host.

Abstract: In one embodiment, at a packet-forwarding engine for receiving packet flows and conditionally routing packets in the packet flows to one or more applications, a method includes receiving from a particular one of the applications a request that requests the packet-forwarding engine not to route the particular one of the packet flows to the particular one of the applications and identifies one or more conditions for routing particular ones of the packets in the particular one of the packet flows to the particular one of the applications. The method further includes, receiving a particular packet in the particular one of the packet flows, determining whether one or more of the conditions for routing the particular packet to the particular one of the applications are met, and routing or not routing the particular packet to the particular one of the applications based on the determination.

Abstract: Disclosed herein in an example embodiment is a multicast policy infrastructure that allows administrators to integrate location awareness for a particular multicast stream when it is being forwarded to an intended user. The infrastructure provides more flexibility by allowing multicast call admission control, access control, and other multicast policies to be based on the location or conditions where the host/user is receiving the multicast stream. A multicast policy can also provide additional mechanisms such as transcoding services, compression services, etc. based on the host/user location. As will be demonstrated in example embodiments herein, location awareness can include connectivity media (wired or wireless), physical location of user, and/or signal strength (and/or effective bandwidth).

Abstract: Disclosed herein in an example embodiment is a multicast policy infrastructure that allows administrators to integrate location awareness for a particular multicast stream when it is being forwarded to an intended user. The infrastructure provides more flexibility by allowing multicast call admission control, access control, and other multicast policies to be based on the location or conditions where the host/user is receiving the multicast stream. A multicast policy can also provide additional mechanisms such as transcoding services, compression services, etc. based on the host/user location. As will be demonstrated in example embodiments herein, location awareness can include connectivity media (wired or wireless), physical location of user, and/or signal strength (and/or effective bandwidth).